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Abstract — An open question in Air Traffic Management is 
what procedures can be validated by simulation where the 
simulation shows that the probability of undesirable events 
is below the required level at some confidence level. The 
problem is including enough realism to be convincing while 
retaining enough efficiency to run the large number of trials 
needed for high confidence. The paper first examines the 
probabilistic interpretation of a typical requirement by a 
regulatory agency and computes the number of trials needed 
to establish the requirement at an equivalent confidence 
level. Since any simulation is likely to consider only one 
type of event and there are several types of events, the paper 
examines under what conditions this separate consideration 
is valid. The paper establishes a separation algorithm at the 
required confidence level where the aircraft operates under 
feedback control as is subject to perturbations. There is a 
discussion where it is shown that a scenario three of four 
orders of magnitude more complex is feasible. The 
question of what can be validated by simulation remains 
open, but there is reason to be optimistic. 12 
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1. Introduction 

This paper first considers the number of trials needed in a 
Monte Carlo simulation to show some algorithm or 
procedure is effective enough to satisfy the safety 
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requirement of a regulatory agency. Demonstrating how to 
compute the number of trials proceeds by example, and the 
examples chosen are several recent expressed FAA goals 
which are given in terms of incidents. There are various 
types of incidents, but for the example in this paper, an 
incident is a loss of required separation for aircraft in flight. 
The goals of regulatory agencies can vary and change, but 
the methods below will remain applicable. In addition, an 
agency may express its goals in another manner, for 
example fatalities-per-year, instead of in terms of incidents, 
but to be suitable for demonstration by Monte Carlo, any 
requirement will have to be interpreted in terms of incidents 
which can be studied by simulation. This material is in 
section two, and it is what most distinguishes this study 
from other efforts. 

Section three presents the assumptions about the aircraft and 
flight space. 

Section four shows that under the assumptions in section 
three the minimum-distance point determines the relative 
angle of approaching aircraft, gives the precise description 
of the maneuver and a pictorial description of the separation 
maneuver. The Appendix contains a proof that the 
maneuver maintains separation if no perturbations are 
present. 

Autonomous aircraft follow their flight paths by means of 
feedback control, and section five describes the control law 
used for the aircraft in the study. The derivation that it is 
stable is in the Appendix. 

Once feedback control is introduced, it is possible to 
include perturbations in a realistic manner, and section six 
describes its stochastic nature with the details in the 
Appendix while section nine offers more commentary. The 
approach to perturbation in this paper is to examine 
distributions of increasing severity. If the algorithm can 
survive these distributions, then it can survive the real world 
perturbations. The severity of the examined perturbations 
can be seen in figure 10 in section six. 

Section seven lists the considerations for choosing the 
minimum-distance point with the details in the Appendix 
while section eight describes the simulations that were 
performed. Since there was no loss of separation in any of 
the trials for any of the simulations, additional work was 
performed to examine the effect of different degrees of 
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turbulence. The parameter examined is the average 
minimum distance, and this effort is described in section 
nine. 

Section ten does a detailed comparison of this work with the 
work performed in the references, and section eleven 
contains the conclusions. 

This paper does not include a test of any decision algorithm 
since such a test should include the uncertainty due to 
instrumentation error where the position and heading of the 
aircraft are not precisely known. 

Finally, this current work does demonstrate that a separation 
algorithm with perturbations from feedback control and 
atmospheric turbulence can be shown to meet a rigorous 
regulatory requirement at a correspondingly high 
confidence level. It is also shown that this project can 
accept a three to four magnitude increase in complexity and 
still remain viable, but clearly this is not enough of a margin 
to include every detail in a global setting. Future work is 
needed in sensitivity analysis to determine what must be 
included in the simulation. 


2. Probability and Statistical Analysis 

Probability 

For concreteness, this paper addresses a recently expressed 
FAA goal which was stated in terms of a moving average: 
no more than three incidents (of all types) over the last three 
years. Since there are about ten million flights per year, this 
translates into one or fewer incidents per 10 million (10 7 ) 
flights. The examination compares this moving average to a 
goal stated in terms of one year. As they stand, these goals 
are not probability statements, and they require 
interpretation. 

In the absence of information and for simplicity, the typical 
assumption is that all flights are equivalent and 
independent, and the typical interpretation of the goal is that 
the expected 

number of incidents for 10 million flights be equal to one. 
Using the expectation does not require any more 
information from the FAA, but it does have a disadvantage 
as will be seen below. 

The disadvantage of this interpretation appears when we 
consider the probability of more than one incident during 10 
million flights. It’s reasonable to want the probability of 
more than one incident to be low, but it will be shown that 
using the expectation-interpretation does not guarantee this. 
On the other hand, the low-probability approach raises the 
question of how low the FAA wishes the probability to be. 
With the assumption that the flights are equivalent and 
independent, the distribution is binomial with the 
probability of an incident equal to le-7 per flight. The 


binomial distribution with parameter p gives the probability 
of zero or one incident during 10 million flights as 

Q = (1-p) 10000000 + 10000000 p (1-p) 9999999 
= 0.7358 if p=le-7. (1) 

The probability of two or more incidents for p = le-7 is 1-Q 
= 0.2642. Hence, if the probability of an incident is equal to 
le-7 per flight, then the probability of more than one 
incident during 10 million flights is greater than 1/4. If the 
goal is a less than one in a hundred chance of more than one 
incident per ten million flights, then a little numerical work 
gives that forp = 1.5e-8, Q = 0.9898 and 1-Q = 0.0102. 

The moving average reduces the likelihood of not achieving 
the goal provided the probability of an incident during a 
flight is smaller than required. Suppose the probability of 
an incident is equal to le-7 per flight. Then 

Prob {more than one incident in a year | p=le-7} = 0.26. 

Prob {more than three incidents in three years | p=le-7} 

= 0.35. 

Whereas 

Prob {more than one incident in a year | p=le-8} = 0.0047. 

Prob {more than three incidents in three years | p=le-8} 

= 0.0003. 

The crossover point appears to be p=7e-8. 

Probjmore than one incident in a year | p=7e-8} = 0.16. 

Prob 1 more than three incidents in three years | p=7e-8} 

= 0.16. 

Returning to the interpretation of the FAA goal as a 
probability statement, one possibility is that the FAA would 
desire there is only 1 in N chance the goal not be met. A 
reasonable choice for N is some number between 10 and 
100. Looking at the extremes, the computations below give 
values for p = probability of an incident during a flight if 
the requirement is a 1 in N chance the goal not be met. 

For N=10: 

The Prob {more than one incident in a year} =0.10 
requires p = 5.3e-8. 

The Prob {more than three incidents in three years} =0.10 
requires p = 5.8e-8. 

For N=100: 

The Prob {more than one incident in a year} = 0.01 
requires p = 1.5e-8. 


2 



The Prob{more than three incidents in three years} = 0.01 

requires p = 2.7e-8. 

Probabilities and confidence levels for the simulation 

A problem in establishing that a loss-of-separation 
algorithm meets the FAA goal is that loss of separation is 
one incident among many. Hence, showing that the 
probability of loss of separation during a flight is less than 
le-7 may not be sufficient since there are other incidents 
and their probabilities accumulate. The problem is 
compounded since when studying incidents, especially the 
prevention of incidents, it is useful to distinguish between 
the potential for an incident and the incident itself. For 
instance, two aircraft on a collision course is a potential for 
an incident, but successful maneuvering will result in no 
incident. In addition, there may be multiple causes for an 
incident or an incident may require multiple causes. There 
may be no cause for alarm if two aircraft are on a collision 
course unless some malfunction prevents successful 
maneuvering. Hence, a precise probability analysis for loss- 
of-separation requires an encyclopedic knowledge of 
incidents and their causes which the author, at least, does 
not currently posses. Nevertheless, an elementary, 
incomplete analysis can offer some guidance. One 
approach in such an analysis is to be conservative: in the 
absence of complete information, use probabilities that 
overestimate the likelihood of dire events. 

We begin with a simplified scenario and then generalize it. 
Suppose there are K types of incidents. Let C ; be the set of 
causes for incident i. Let B (for benign) be the set where no 
causes for an incident occur. The initial simplifying 
assumption is that the Q and B partition the set of flight 
conditions. That is, the intersection of two different sets is 
empty, and their union is the entire set. This initial 
simplifying assumption is justified if incidents are rare and 
flights with more than one incident are rare enough to be 
ignored. With this approach, the study of an incident i 
consists of the study of the effect of the set Q. For 
instance, for this study of loss-of-separation, the causes are 
deviations from the flight paths due to feedback control and 
external perturbations. The realism of the simulation is 
increased by adding more causes. 

Let P(A i | C ;) be the conditional probability of an incident 
given that its causes appear. Then we want 

P(A,|C 1 )P(C 1 ) + P(A 2 |C 2 )P(C 2 )+... 

+ P(A K |C K )P(C K )<p. (2) 

Based on the assumption that there is a positive probability 
that a flight is routine (no cause for an incident appears), we 
have 

P(C 1 )+...+ P(C K )<l. (3) 


Using this assumption, one way to accomplish this is to 
have P(A i | C j ) < p for all i since this gives 

P(A 1 |C,)P(C 1 ) + P(A 2 |C 2 )P(C 2 )+... 

+ P(A k |Ck)P(C k ) 

<pP(C 1 )+pP(C 2 )+...+ pP(C K ) 

<p[P(C 1 )+...+ P(C K )]<p. (4) 

The generalization of the above eliminates the partition 
requirement. That is, different C , can have a non-empty 
intersection, allowing for more than one incident per flight. 
The reasoning above still holds if P(C i ) + . . .+ P(C K ) < 1, 
which this paper will assume. 

There are two cases where the approach above requires 
modification. First, if the sets C , have significant overlap, 
then the probabilities can sum to greater than 1 . If a bound 
for the sum of probabilities is known and it is less than M, 
then it is sufficient to demonstrate P(A , | C ,)< q where q 
M < 1, although if there is significant overlap, then the 
studies will have to examine the probability that a single set 
of causes produces several incidents. 

Second, a scenario that would require a different type of 
analysis is if a set of causes had a high probability of 
producing an incident. That is, for some j, P(A ,| C j) cannot 
be made small. In this case, the alternative is to arrange 
things so that C j is small. 

Confidence levels for the simulation 

The driver for Monte Carlo is the required confidence level 
which is a quantitative statement about the quality of the 
experiment. The frequency interpretation is that a 
confidence level of 100( 1 - h )% means there is a lOOh % 
or less chance that the experiment has misled us. This paper 
takes the point of view that the quality of the experiment 
should match the quality of the desired results. That is, if 
the probability to be established is p, then the confidence 
level should be at least 100( 1 - p )%. Hence, this paper 
will seek confidence levels of at least 100( 1 - le-7 )%. 
The confidence level may need to be even higher because 
loss-of-separation is only one incident among many. The 
final confidence level must combine the confidence level of 
a number of experiments. A result in combining confidence 
levels is the following. 

Theorem: Suppose (aj , b j ) is a 100( 1 - h j )% confidence 
interval for 0 , for 1 <j < n, then [ (aj , b j ), ... (a n , b n ) ] is 
a 100( 1 - h ] - - h „ )% confidence interval for 

(01,...,0n). 

For example, if there are 10 parameters to be estimated with 
a desired overall confidence level of 100( 1 - le-7 )%, then 
it is sufficient to estimate each of the parameters at the 100( 
1 -le-8 )% level. In general, the individual confidence 
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intervals do not need to be the same although the lack of 
confidence must have a sum less than or equal to le-7. 
Assuming all the trials are successful and given a desired 
probability p and confidence level h, the formula for 
computing the number of trials is 

( 1-p ) n = h . (5) 

The reasoning is that ( 1-p ) is the probability of success 
(equivalently the non-occurrence of a failure) and repeated 
successes (n of them) implies that p is small. The 
probabilities (values of p) that appear in table 1 are 
computed from the discussions above. 


Table 1. Number of trials given requirement and number 
of types of incidents 


Requirement 

Value 

Types of 

Types of 


of p per 

incidents is 

incidents is 


flight 

100 

1000 



Confidence 

Confidence 



level is 

level is 



1- 

1- 



p x (le-2) 

p x (le-3) 



Number of 

Number of 



trials 

trials 

Expected 
number of 
incidents per 
year is 1 

1.0e-7 

2.1e+8 

2.3e+8 

Probability 
more than 1 

5.3e-8 

4.0e+8 

4.5e+8 

incident a 
year is 0.10 




Probability 
more than 1 

1.5e-8 

1.5e+9 

1.7e+9 

incident a 
year is 0.01 




Probability 
more than 3 

5.8e-8 

3.7e+8 

4.1e+8 

incidents in 3 
years is 0.10 




Probability 
more than 3 

2.7e-8 

8.2e+8 

9.0e+8 

incidents in 3 
years is 0.01 





Baseline for simulation effort 


Since the primary concern of this paper (and future efforts) 
is introducing realism while maintaining enough efficiency 
to establish the algorithms at the required probability and 
confidence levels, it is worthwhile to state what this study 
says about such efforts. The case chosen is that the 
requirement is the probability of more than 3 incidents in 3 
years is 0.10 and there are 100 types of incidents. This 
requires 370,000,000 trials. Using a desktop computer and 
an interpretive language, it took 25 hours to run this many 
trials. Assuming that it is feasible to run the program for 
half a year, that it is feasible to use 10 to 100 desktop 
computers, and that more efficient programs and faster 
computers are available, this implies it would be possible to 
run a simulation that is three or four orders of magnitude 
more complex. 


3. Assumptions for the Simulation 

As an early effort (for the author), there are a number of 
assumptions. (1) Only two aircraft at a time are considered. 

(2) All aircraft have the same speed and maintain this speed. 

(3) All scenarios are two-dimensional: all maneuvering is at 
a constant altitude. (4) The position and heading of all 
aircraft is precisely known. (5) Both aircraft know which 
one will make the collision-avoidance maneuver and what 
the maneuver will be. (6) Only approaching aircraft are 
considered for the reason below. This study restricts itself 
to approaching aircraft since for aircraft on nearly 
coincident courses, it is possible that a simple jog will not 
prevent loss-of-separation as illustrated in figure 1 . 



Figure 1 - Two aircraft on nearly coincident courses 

The solution is either trivial: have one aircraft perform a 
circle for delay, or it is global: have one aircraft change 
altitude or arrange traffic to avoid such circumstances. 
Hence, the examination of nearly-coincident flight paths is 
postponed to a later study. 


4. The Minimum Point and Flight angles 

For algebraic and geometric convenience, we establish the 
coordinate system such that the first aircraft travels along 
the x-axis and the two aircraft are their minimum distance 
apart when this first aircraft is at the origin. An example is 
given in figure 3, which shows the first aircraft traveling on 
the x-axis with a flight angle of zero and the second aircraft 
approaching the first at an angle a. In figure 3, a is 
between n/2 and 3 ti/2. 

Initially, we let the second aircraft approach the first at any 
angle although we later restrict the study to aircraft with 
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opposite headings. 


cos a = 


The first result is that the minimum-point for the second 
aircraft determines its flight angle except for the special 
case where the minimum point is (0,0). Let the minimum 
point for the second aircraft be (a,b). 

The parametric equations for the original paths for the first 
and second aircraft are 

x t =t 

y 1 =0 

x 2 =a + tcosa (6) 

y 2 = b + 1 sin a 

where a is the angle of approach of the second aircraft and 
where t can take negative values and is zero at the minimum 
point (a,b) for the second aircraft. The distance-squared and 
its first and second derivative are 


a 2 -b 2 

a 2 +b 2 
2 a b 

2 i 2 

a + b (10) 

Since we are considering approaching aircraft, the cosine 
for the flight path of the second aircraft is negative. Hence, 
for the minimum-point (a,b), b > a. 

Description of Modified Flight Paths 

The trigonometric result in the last section makes it natural 
to divide the region containing the minimum-distance points 
into four sectors where the angles range from ti/ 4 to ti/ 2, 
from 7i/2 to 3 tc/ 4, from 5 ji/ 4 to 3n/2, and from 3 ti/ 2 to 7 tc/4. 

The sine of the trajectory is positive in the first sector, 
negative in the second, positive in the third, and negative in 
the fourth. This change is illustrated in figure 3. 


a + 1 cos a - 1 ] 2 + [b + 1 sin a \ 2 

= 2 [a + 1 cos a - 1 ][cos-l]+ 2 [b + 1 sin a] [sin a] (7) 
dt 

^ ^ = 2[cos« - l] 2 +2 [sin a] 2 

dt 2 L J L J 


Since the second derivative is positive, the zero-value of the 
first derivative gives a minimum. Skipping some algebraic 
steps, setting the first derivative equal to zero gives 

0 = a [coscr - lj + bsincr (8). 




Placing sine and cosine on opposite sides of the equation, 
squaring, substituting, and solving the quadratic gives 


a ~-b , 

cos a = — -,1 (9) 

a 2 +b 2 

The value 1 corresponds to the two aircraft flying in parallel 
a constant distance apart. That case will not be considered 
in this study. 

Hence, except for the point (0,0), the minimum-distance 
point determines the flight path of the second aircraft with 


Figure 2 - The changes in flight-path angle according to 
the location of the minimuni-distance point 

The basic algorithm is that the second aircraft to reach the 
point of path-intersection turns into the path of the other 
aircraft. This algorithm does not cover parallel paths when 
the minimum-point lies on the y-axis, but for this study, this 
event has probability zero and is temporarily ignored since 
more robust algorithms must handle uncertainty due to 
instrumentation error. As an example, consider two aircraft 
whose initial minimum distance point is in the upper right 
sector of those displayed in figure 2. 
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Figure 3 - Flight paths when the minimum-distance 
point lies in the first sector 

This study does not consider the event where the 
approaching angle is n or when the minimum-distance point 
for the aircraft coincide at (0,0). In this study both events 
have probability zero, although a more realistic study that 
considers instrumentation error would have to include these 
events because they have a positive probability. 

To begin the description of the maneuver, consider the 
aircraft depicted in figure 3. Ignoring the parametric aspect, 
imagine the flight paths as lines in space that intersect. The 
aircraft that reaches this point first continues on its original 
path. The aircraft that reaches this point second is the one 
performing the maneuver. 

The goal is to maintain 5 nautical miles of separation. The 
maneuver begins 20 nautical miles from (0,0), the minimum 
distance point for the first aircraft. It makes a ji/4 turn into 
the oncoming aircraft and travels 14.4 (ten times the square 
root of two). It returns to its original flight angle where it 
travels 20 nautical miles and makes a ji/4 turn to travel 14.4 
nautical miles back to its original flight path. This is 
illustrated in figure 4. 



Figure 4 - The separation maneuver when the 
minimum-distance point lies in the first sector 


By symmetry, we need consider only the scenario in figure 4. 


5. The Feedback Equations 

Both aircraft are guided by onboard digital controllers. 
Hence, the desired flight path is given by a sequence of 
points: the positions the aircraft should be at the end of a 
control cycle. 

The feedback control law is a modified PID (Position- 
Integral-Derivative) that pivots on the velocity vector. If it 
pivoted on distance, the aircraft would be constantly 
lurching forward to the next point on its path. Hence, for 
this controller, the velocity vector plays the role of P, the 
acceleration plays the role of D, and the error between the 
actual point of the aircraft and the desired point plays the 
role of I. The control law and the demonstration that it is 
stable are in the Appendix. 

Continuing to choose numbers convenient for scaling, this 
study assumes an aircraft speed of 600 knots and a control- 
time interval of one second, which implies the five nautical 
mile separation requirement translates into a distance of 30 
units in the simulation. 

The control law mentioned above and derived in the 
Appendix can take the aircraft through the required turn of 
ji/4 radians. As expected, there is a small overshoot at the 
corners. The effect of the overshoot is displayed and 
examined in section six. 


6. The Turbulence Model 

Description 

This section describes the external turbulence applied to the 
aircraft. The assumption is that turbulence is the 
accumulation of small effects which implies it has a normal 
distribution. Since the flight path is two-dimensional, the 
turbulence has an x-component and a y-component. In this 
study, the x-component and y-component are independent 

For both components, the force is a constant over the 
control interval of one second. The generality of this 
assumption will be studied in the Appendix. 

The variants are the variance of the normal distribution, the 
correlation between the aircraft, and the correlation in time. 
This paper uses standard deviations of 1/10 and 1 for the 
normal distribution. For correlation between the aircraft, 
the two aircraft experience the same turbulence or 
experience independent turbulence. Time correlation is 
more complicated. 
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Time correlation is introduced by having the mean of the 


distribution for step k+1 depend on the values chosen for 
step k. If x k is the value for the turbulence in step k, then 
the value for the turbulence in step k+1 is chosen from a 
normal distribution with mean c x k for some positive 
constant c. All the distributions have the same variance o 2 . 

The derivation of the properties of this stochastic process 
are in the Appendix. 

Miscellany on perturbations 

The graph in figure 5 shows the aircraft making the 
separation-maneuver moving under feedback control with 
no perturbation present. Note the overshoot at the corners. 

In both figures 5 and 6, the distance in nautical miles is 
indicated on the axes. The numbers at the bottom of the 
graph give the elapsed time in seconds. 

The mean and standard deviation of the error for distance 
were estimated. The path in figure 5 lasts 320 seconds 
which is 320 discrete control intervals. At the end of each 
control interval the difference between actual position and 
desired position was computed. This computation was 
performed for 3000 flight paths or 960,000 points. The 
results are mean = 3.7298e-4 and standard deviation = 
0.1531. 

The graph in figure 6 shows the aircraft making the 
separation-maneuver moving under feedback control with 
perturbation present. This perturbation is one of the more 
extreme ones with the variables initially chosen from the 
normal with standard deviation 1 and then given time 
correlation with c = 1/2. 

Once again, there were 3000 trials with 320 points per trial. 
For this case, the error had mean = 0.0068 and std = 
4.3898. 

There are additional areas for investigation for 
perturbations. One item not covered in this study is when 
the perturbation has a drift, a constant non-zero value for its 
mean. 

Another item is whether or not it is possible to establish a 
high probability envelope for the path of the aircraft in the 
presence of perturbations. Such an envelope would imply 
that a separation algorithm that allowed for the envelope 
could be proved, and the need for studying the separation in 
the presence of perturbations would be eliminated. 


7. Choosing the Minimum Distance Point 

Randomly choosing the minimum-distance point in the 
sector for a trial brings up two problems. The first problem 
is what is the actual distribution for air traffic. This is not 


known to the author. Since the usual response to such lack 
of information is to use the uniform distribution, the second 
problem is obtaining a distribution and demonstrating it is 
uniform, which is presented in the Appendix. 


8. The Simulation Cases 

Eight Monte Carlo experiments were performed, each with 
370,000,000 trials. 

The aircraft had identical or independent perturbations. 

The initial random variable had std =1/10 or std = 1. 

The correlation constant was c = 0 or c = 'A. 

There was no loss of separation in any of the trials. 

For each case, the experiment showed that the probability of 
more than 3 incidents in three years is less than 0.10 at the 
100( 1 - le-9 ) confidence level, which is the confidence 
level appropriate if there are 100 types of incidents. 


9. Minimum Distance Estimation 

It’s satisfying that the separation algorithm handled all the 
perturbation cases, but it gives no insight with respect to the 
effect of the perturbations. This section attempts to remedy 
this by estimations of minimum distance. For each set of 
conditions, one million (le+6) trials were conducted, and 
the minimum distance of the two aircraft was recorded for 
each trial. For each set of conditions, the mean, standard 
deviations, and 99% confidence interval for the minimum 
distance were computed. 

Since this comparison of conditions is not related to any 
FAA requirement, the investigation does not require 
meeting the confidence level of incidents, and the 99% 
confidence interval is sufficient to compare results. 

To make the results more comparable, each experiment used 
the same set of (le+6) points in the sector. The points were 
chosen according to the uniform-criteria in section ten with 
the angles and radii given by 

ak = 7i/4 + kn/4000 for k = 1, ..., 1000 

(40) 

r k = sqrt ( k/1000 ) for k = 1, ..., 1000 . 
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Figure 5 - Path of maneuvering aircraft moving with feedback. The marks on the axes indicate five-mile intervals 
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Figure 6 - Path of maneuvering aircraft in the presence of perturbations. 
The marks on the axes are five-mile increments 


The parameters that were varied were 

The perturbations for the two aircraft were either 
identical (pert2=pertl) or independent (Ind). 

The initial random variable was chosen from a 
normal distribution with mean = 0 and std = 1/10 
or std = 1 . 


From an examination of the table, the major factor is the 
standard deviation of the original normal distribution. Once 
this standard deviation is large, the correlation factor 
becomes significant. 


The correlation constant was 0 or Vi. 


The results for the eight cases are given in table 2. 


Table 2. Estimated mean, standard deviation, and 99% 
confidence interval for minimum distance 


Conditions 

mean 

std 

99% int 

Pertl=pert2 
Std = 1/10 
C = 0 

67.3279 

1.5910 

67.3238 

67.3320 

Pertl=pert2 
Std = 1 
C = 0 

65.9497 

1.7335 

65.9452 

65.9542 

Ind 

Std = 1/10 
C = 0 

67.1959 

1.6200 

67.1917 

67.2001 

Ind 

Std = 1 
C = 0 

63.0055 

2.8300 

62.9981 

63.0129 

Pertl=pert2 
Std = 1/10 
C= 1/2 

67.2951 

1.5941 

67.2910 

67.2992 

Pertl=pert2 
Std = 1/10 
C= 1/2 

65.3106 

1.8880 

65.3057 

65.3155 

Ind 

Std = 1/10 
C= 1/2 

67.0579 

1.6499 

67.0536 

67.0622 

Ind 

Std = 1 
C= 1/2 

60.5988 

3.6930 

60.5892 

60.6084 


10. Discussion for References 

There is no lack of publications about separation assurance 
or, when things get more desperate, collision avoidance. In 
comparing this effort to other publications, the salient points 
are (1) examination of the FAA requirements as probability 
conditions, (2) integrating the combined realism of feedback 
control and perturbations, and (3) determining and 
performing the necessary Monte Carlo trials. 

The paper [1] sets up a framework to review 68 conflict 
detection and resolution methods, but there is no discussion 
of their verification. The paper [2] examines a three 
dimensional algorithm for collision avoidance, but there are 
no perturbations, and only a few test cases. The paper [3] 
includes human in the loop with the intent of moving from 
sector to global implications to improve efficiency, but there 
is no mention of FAA safety requirements. The paper [4] 
identifies possible areas to investigate for improvement of 
efficiency, but there is no mention of FAA safety 
requirements. The paper [5] proposed a conflict resolution 
algorithm and tested it using real data where it appeared to 
be about 97% successful. The paper [6] develops and tests 
an operating concept and a laboratory analysis methodology 
to examine how four-dimensional trajectory analysis 
methods could support higher levels of automation for 


separation assurance while recognizing that trajectory 
prediction uncertainties can be on the same order of 
magnitude as safe separation criteria, which implies that 
uncertainty is an important consideration, but there is no 
reference to the FAA requirements. The paper [7] attempts a 
global simulation of the Australian airspace to study the 
feasibility of free flight. It contains numerous realistic 
elements, but there is no quantitative study of safety with 
confidence levels. The paper [8] applies integer 
programming to solve conflict resolution for multiple 
aircraft, and several examples are presented, but the 
program is not established at any confidence level. 

11. Conclusions 

The primary objective of this paper is to establish that an air 
traffic algorithm meets a stringent requirement at a 
correspondingly high confidence level. 

There is first a discussion of representative FAA 
requirements, their probabilistic interpretation, and the 
number of trials needed in a Monte Carlo simulation for the 
various requirements and interpretations. The algorithm 
chosen is flight separation for approaching aircraft. It is 
first shown that the minimum-distance point of the aircraft 
determines their flight angles. With this result in hand, the 
algorithm is described and an analytical proof of the 
algorithm is given for idealized flight paths. 

Next, two items are introduced for realism. A modified PID 
control law is proposed and shown to be stable. Once the 
control law is in place, perturbations can be introduced as 
external forces. The parameters of the perturbation are the 
standard deviation, the correlation between aircraft, and the 
time correlation. The stochastic properties of the 
perturbation are derived. Monte Carlo simulation shows the 
separation-algorithm meets a chosen FAA requirement for 
eight cases of the perturbation. A minimum-distance study 
shows the different perturbations have different effects. 
The natural extensions to this effort are to consider more 
than two aircraft, a more global setting, wind, and 
instrumentation errors. Wind, for instance, can be included 
by letting the random variables have a nonzero mean. 
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Appendix 

This appendix has four subsections. There is an analytical 
demonstration of the separation algorithm when no 
perturbations are present, a description of the control law 
and a verification it is stable, derivation of the stochastic 
properties of the turbulence model, and a discussion of 
choosing the random minimum-distance points. 

Analytical Demonstration of Separation 

We will show the maneuver displayed in figure 4 maintains 
separation. We begin by scaling the required minimum 
distance to 1. We also scale the time parameter so that an 
aircraft travels a distance 1 in one time unit. As before, a is 
the flight angle of the second aircraft. 

Showing the two paths maintain separation is an exercise in 
calculus. The idealized paths are either a single straight line 
or a sequence of straight lines. The demonstration pivots on 
the path that is a sequence of straight lines. Each segment is 
examined at its endpoints and zero value of the derivative of 
the distance when traversing the straight line segment. 

First, there are the endpoints and parametric equations for 


each of the segments. 

For the first segment, the aircraft begin 4 units from their 
minimum distance points. 

Xl (t) = -4+^ t 

V2 

yi(t) = 0 -A_ t 

(A - 1) 

x 2 (t) = a - 4 cos a + t cos a 
y 2 ( t ) = b - 4 sin a + t sin a 

for 0 < t < 2 yfl 

For the second segment, the first aircraft goes from (-2,-2) 
to (+2,-2) 


x | (t) = -2+ t 

y i (t) = —2 


(A -2) 


x 2 (t) = a - (4 - 2V2 ) cosa + t cosa 
y 2 (t) = b - (4 - 2V2) sina + t sina 

for 0 < t < 4 

For the third segment, the first aircraft goes from (+2,-2) to 
(+4,0) 

, , „ V2 

x 1 (t) — +2 + -^- t 


yi(t) = -2+^ t 


x 2 (t) = a + 2V2 cosa + 1 cos« 
y 2 (t) = b + 2->/2 sina + 1 sina 


(A -3) 


for 0 < t < 2 


We can first check the distances at the endpoints, which 
correspond to the corners for the path of the aircraft making 
the maneuver. 

From equations (A-l), the first endpoints and distance- 
squared are 
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(-4, 0); (a-4cosa, b- 4sina) 
s 2 = [a -4 cosa + 4] 2 +[b- 4 sina] 2 (A -4) 

Since cosine is less than or equal to zero, the expression 
inside the first bracket is greater than or equal to 4, which 
implies the distance is greater than or equal to 4. 

The second endpoint and distance-squared from equations 
(A-2) are 

(- 2, - 2) ; (a - (4 - ijl) cos a, b - (4 - 2^2) sin or) 

S 2 =[a-(4-2V2)cosa + 2] 2 (A -5) 

+ [b - (4 - 2>/2) sina + 2 ] 


s 2 = 


V2 


-1 2 


a -4 cosa + t cosa + 4- t 

2 


V? 


b - 4 sina + t sina H — — t 
2 


for 0 < t < 2 V 2 


(A -8) 


Now, ( -4 + t ) cosa is greater than or equal to zero, and 
•\/2 

4 — — t is greater than or equal to 2. Hence, the distance 
is greater than or equal to 2. 

The distance while traversing the second segment in terms 
of the parametric equations (A-2) is 


Since cosine is negative, the term inside the first bracket is 
greater than or equal to 2, which implies the distance is 
greater than or equal to 2. 


s 2 = [a - (4 - 2 V 2 ) cosa + t cosa + 2 1 - tj 

+ [b - (4 - 2 V 2 ) sina + t sina + 2 ] (A - 9) 


The third endpoint and distance-squared from equations (A- 

3) are The derivative is 


(- 2, - 2) ; (a + 2 V 2 cosa, b + 2 V 2 sina) for t = 0 
s 2 = [a + 2 V2 cosa - 2 ] 2 + [b + 2 V 2 sina + 2 ] 


(A -6) 


= 2[a - (4 - 2 V 2 ) cosa + t cosa + 2 1- t][cosa - 1] 

+ 2[b-(4-2V2) sina+ t sina + 2 ][sina] (A -10) 


Since sine is positive, the term inside the second bracket is 
greater than or equal to 2, which implies the distance is 
greater than or equal to 2. 

The fourth endpoint and distance-squared from equations 
(A-3) are 


The second derivative is 


— — ^ = 2 [cosa - 1] 2 + 2 [sin a] 2 
dt 2 


(A -11) 


(+4, 0);(a + 4V2 cosa, b + 4V2 sina) 

s 2 =[a+4V2 cosa - 4 ] +[b + 4V2 sina] (A -7) 


which is positive. Hence the zero value for the first 
derivative gives a minimum. 

Setting the derivative equal to zero and solving for t gives 


Since cosine is negative, the expression inside the first 
bracket is less than or equal to a-4, and since a is less than 
or equal to 1, the expression is less than or equal to -3, 
which implies the distance is greater than or equal to +3. 

Next we consider the distances while traversing the 
segments between the endpoints. 

The distance while traversing the first segment in terms of 
the parametric equations (Al) is 


t = 3 - V 2 


sin a 
- 1 + cos a 


(A -12) 


Substituting this value for t into the original distance 
formula and some algebra give 

s 2 = [a +{-\ + 4l) cosa -1 + -J2 + sina] 

+ [b+ (-1 + V2) sina -cosa + l] (A-13) 
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Since all the terms in the expression in the second bracket 
are positive, the distance is greater than or equal to 1 . 



The distance while traversing the second segment in terms 
of the parametric equations (A-3) is 


The acceleration is constant throughout the interval 

[k, k+1] while v(k+l) and s(k+l) are the values at the end 

of the interval. 


s 2 = 


V2 


l 2 


a + 2V2"cos« + t cos« -2 t 

2 


b + 2->/2 sina+ tsina + 2-^- t 

2 


for 0 < t < 2 -\/2 


Now, 


(A - 14) 


For the second equation, subtract v d (k) from both sides 
andusev d (k) = v d (k+l). 


For the third equation, use 

s d (k + l) = s d (k) + r v d (k) 

To get 


(A -17) 


s(k + l)-s d (k + l) = [s(k) -s d (k)J+r[v(k)-v d (k)J (A-18) 


2 V 2 cosa + t cosa - 2 — t<0-2 — t< -2. (A-15) 

2 2 

Since a is less than or equal to 1, the expression inside the 
first bracket is less than or equal to -1, which implies the 
distance is greater than or equal to 1 . 

Description and stability of the control law 

The aircraft is treated as a constant point of mass 1 . Flence, 
the acceleration is proportional to the applied force. The 
distance between points is also normalized to 1. This last 
normalization is different from the normalization used in the 
analytic derivations for the idealized paths. This last 
normalization, of control-distance equal to 1, will be the one 
used for the rest of this paper and in the computer 
simulation. 

At the time interval k, let 

a(k) = current acceleration at time k 
v(k) = current velocity at time k 
s(k) = current position at time k 
v d (k) = desired velocity at time k 
s d (k) = desired position at time k 
1 = control time interval 

In the equations a(k) is the acceleration from k to k+1. 
Hence, v(k+l) depends on v(k) and a(k) while s(k+l) 
depends on s(k), v(k), and a(k). The equations show 
adjusting the acceleration for the next time interval from 
k+1 to k+2 and are 

a(k+l) = a a(k) + p [ v(k) - v d (k) ] + 5 [ s(k) - s d (k) ] 
v(k+l) = v(k) +xa(k) 

s(k+l) = s(k) + x v(k) + (x 2 12) a(k) (A- 16) 


This gives 

a(k + 1) = a a(k) + p [v(k) - v d (k)J+ S [s(k) - s d (k)j 
v(k + 1) - v d (k + 1) = [v(k) - v d (k)]+ r a(k) 

(A -19) 

s(k + l)-s d (k + l) = [s(k)-s d (k)]+r[v(k)-v d (k)] 

r 2 ™ 

+ — «a(k) 

which yields the coefficient matrix 


a P 8 

T 1 0 

T — r . 

L 2 

For the time and gain values 
i=l 

a=- 0.001 


(A -20) 


(A-21) 


P = - 0.5 
5 = - 0 . 2 . 

The eigenvalues are 0.4346, 0. 7822+0. 5534i, and 0.7822- 
0.5534i, which have magnitudes less than one. Hence the 
system is stable. A more realistic study would include a 
more detailed model of the aircraft and base the control 
parameters on the aircraft’s performance. 


Derivations for the stochastic process 
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As described in section six, the turbulence is treated as an 
external force, and the assumption is that turbulence is the 
accumulation of small effects which implies it has a normal 
distribution. Since the flight path is two-dimensional, the 
turbulence has an x-component and a y-component. In this 
study, the x-component and y-component are independent 

For both components, the force is a constant over the 
control interval of one second. The generality of this 
assumption will be studied below. 

The variants are the variance of the normal distribution, the 
correlation between the aircraft, and the correlation in time. 
This paper uses standard deviations of 1/10 and 1 for the 
normal distribution. For correlation between the aircraft, 
the two aircraft experience the same turbulence or 
experience independent turbulence. Time correlation is 
more complicated. 

Time correlation is introduced by having the mean of the 
distribution for step k+1 depend on the values chosen for 
step k. If x k is the value for the turbulence in step k, then 
the value for the turbulence in step k+1 is chosen from a 
normal distribution with mean c x k for some positive 
constant c. All the distributions have the same variance a 2 . 

Suppose x k is the value for step k, and suppose the z ; ‘s are 
from a normal distribution with mean zero and variance o 2 . 
Then x k+1 is given by 

x k+l = c x k + z k+l 

= «(cx k . 1 +z k )+z k+1 (A - 22) 

k k-1 

= C Zj+C Z2+-*. + CZj i +Z j£_|_i 

Using the standard results for the means and variances of 
independent variables, the means and variances for this 
stochastic process are 


mean 
var 


(x k )= mean (c k_l Z\ 
( x k)=var(c k4 Zl 


+ c Z 2 - t - *** + z^|— 0 




+ C Z 2 + . . . + Z k 


2k-2 2 , 2k-4 2 , ,2 2,2 

= c a +c a +...+ c a +a 


1 — c 


2k 


vl-c V 

2 


if c + 1 


(A -23) 


= ke- 


if c = 1 


Using the result on expectation that E[ z ; z j ] = 0 if the z’s 
are independent variables with zero means, the covariance 
of the process is 


E [ ( x n+k - 0 ) ( x n -0)J 


= E 


= E 


n+k-l 


k-1 


ZJ+... + C _z n +c z n+1 ... + z n+k 
(c n 1 Zj +... + z n )_ 


2n+k-2 „ 2 


k 2 


Zj +... + C z 


c k Ic 

j=l 


2n-2j 


(A -24) 


i 2 n 

= c k cr 2 ifc + 1 

1-c 2 


= n cr if c = 1 


It can be seen that if c < 1, then the covariance goes to zero 
as k, the distance between the two points, becomes large. 
Also, as n becomes large, the process approaches a 
stationary process: the covariance depends only on the 
distance between the variables. 

We next look at the effect of the turbulence (the stochastic 
process) on the control states of acceleration, velocity, and 
distance. There is a slight shift in notation since we follow 
the control theory convention of indexing the initial 
parameters with zero. Let y be the state vector and x the 
stochastic input. 

y(l) = Ay(0) + Bx(0) 
y(2) - A y(l)+ B x(l) 

= A 2 y(0) + A B x(0) + B x(l) 

i (A -25) 

y( n ) = A n y(0)+ XA"- 1 ^ Bx(k) 
k=0 


Since the system is stable, the first term converges to the 
desired acceleration, velocity, and position(s). Since the 
x(k)’s are normal with mean zero, the error from turbulence 
(the stochastic process) is normal with mean zero. No 
attempt has been made to derive the variance of the error 
although it could be obtained empirically from simulation. 
Section nine estimates the mean and variance for one set of 
turbulence parameters. 

The final topic in this section asks if the turbulence model 
technique of applying a constant force for a discrete interval 
is completely general. Can some type of average duplicate 
the effect of any function of force over that interval? The 
answer is no. Consider a point of mass 1, a time interval of 
1, and the force function 


I 2 for0<t<l/2 
[0 forl/2<t<l 


(A -26) 


At time t=l, the velocity and position are 
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v = f(t) 


= 1 


s = - 


f(t) 


T 2 

2 


- (l) (l / 2) = 3/4 


(A -27) 


To this end, choose n 1 and n 2 independently from a 
uniform distribution, and form the point with angle 


n n 
— + — 


4 4 


n l 


and radius 



. Then 


To duplicate the result, a constant force a over the interval 
must satisfy the equations 

v = 1 =a(l) = a 

s = 3/4= " [l] 2 =a/2 (A -28) 


which is not possible. 

Choosing the minimum-distance point 

This subsection covers choosing the minimum-distance 
point, which determines the relative angle of the aircraft, in 
such a manner that all points in a sector are equally likely. 

Suppose the sector is part of a circle of radius 1 . Consider 
an arbitrary subsector as in figure A-l. 


71 71 I 

Prob<j/?! <- + -n| — P 2 an d r l--\] n 2 - r 2 


= Prob <| Pi -j + jn] <P 2 


xProbi r 1 < /n -> < r 


= Prob 


f 4 4 


IK 


-l<n j < — P 2 -1 

71 


xProbjr 2 < n 2 — r 2 

[P\ ~ Pi )( r 2 _r l 2 ) 


(A -30) 


Hence, the probability that the point is in the subsector is 
equal to the relative area of the subsector which gives a 
uniform distribution for points in the sector. 
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Figure A-l - Subsector inside a sector 

Suppose the subsector lies between angles P 1 and P 2 and 
radii r j and r 2 . The area of the subsector divided by the 
area of the one-eighth circle is 


( 2 2^ 

(Pl-PA 

V r 2 J 

{ 2 K ) 


K 


(A -29) 


= ^[Pl-Pl){4-^) 


We have a uniform distribution in the sector if the 
probability of a point being in the subsector equals its 
proportional area. 
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